EP2160857B1 - Checking method and electronic circuit for the secure serial transmission of data - Google Patents

Abstract

A checking method in which serial data protected by check data are transmitted via a serial data bus from a transmitter to a receiver, the receiver then conditions the data and compares them with the transmitted check data in order to recognize transmission errors, wherein the transmitter bases the production of the check data and the receiver bases the conditioning of the data on the same check data formation method, wherein the check data formation/conditioning is performed using error recognition hardware, wherein the region of the receiver contains not only the error recognition hardware but also error recognition software which are used to additionally check the received data, and wherein also an error in the transmitted data and/or check data is caused by a transmitter-end error stimulation. A transmission and reception circuit for carrying out the above method and also the use thereof is also disclosed.

Description

The invention relates to a test method according to the preamble of claim 1, an electronic transmitting or receiving circuit or a transceiver comprising a transmitter and a receiver, according to the preamble of claim 7 and their use.

Serial bus systems such as "Controller Area Network" (CAN), Flexray (R) or "Serial Peripheral Interface" (SPI) are already used in automotive electronics for networking electronic control units or microcontrollers. These serial bus systems have in common that the data to be transmitted in data telegrams (frames) are divided. Each data telegram is appended with a CRC checksum calculated in accordance with a generator polynomial (CRC: C yclic R edundancy C heck). The CRC check of data is among others from the DE 41 30 907 A1 , of the EP 1 763 168 A1 , of the DE 33 35 397 A1 or the WO 2006/058050 A2 known in itself.

From the WO 2006/058050 A2 shows a CRC error detection system in which a manipulation of CRC data (CRCcorrupter) is made. The manipulation is performed to create a particular synchronization condition or to provide the receiver with particular status information. This has the disadvantage that the CRC check is not active at least during the transmission of some data packets. The security of the transmission is therefore reduced. Another disadvantage is that an actual error in the CRC data can in principle trigger an unwanted synchronization event.

As is known, the means for generating the CRC check data are generally implemented as hardware means. Securing the data using traditional CRC check data means that no one hundred percent data backup is achieved. The remaining residual error can be calculated or estimated either analytically or by simulations for a given length of data telegrams.

In the already mentioned above EP 1 763 168 A1 In order to reduce the residual error, it is proposed to form a second CRC fuse attachment.

The object of the present invention is also to reduce the residual error in CRC test data secured serial data transmission over the prior art.

This object is achieved by the method according to claim 1.

In the test method according to the invention, serial data secured by test data is transmitted via a serial data bus from a transmitter (303) to a receiver (304). In the receiver, the data is at least partially processed and compared with the transmitted test data for the detection of transmission errors. In the processing of the data in the receiver or during the generation of the test data, which are preferably CRC test data, the transmitter uses the same test data formation method. The Prüfdatenbildung / -aufbereitung done by means of error detection hardware.

According to the method of the invention, an error in the transmitted data and / or test data by a transmitter Error stimulation caused. This can improve the data transmission security of a serial bus system using, for example, a conventional, commonly used CRC generator polynomial. An increase in data transmission security would also be possible by using a more complex CRC polynomial, but this would lead to an undesirable change in the usual polynomial.

In addition to the error detection hardware, error detection software is also provided in the area of the receiver with which the received data is additionally checked. With this method step, the residual error mentioned above can be reduced and thus the safety dimension of the serial connection can be increased. The software means is, for example, a software program which performs an error detection method with which the error rate can be lowered and thus at least theoretically increase the security measure of the transmission.

However, a quantitative proof or a check of the actual error detection rate of the additional software function is hardly possible in practice. If an error check consisting of software and hardware means exists in the area of the receiver, an independent test of the reliability and quality of these means during the serial transmission by fed-in errors can be carried out particularly easily, in which the errors in the data to be transmitted and / or test data be specifically implanted. The targeted implantation (stimulation) of an error can be done by an error stimulation means in the transmitter. The error stimulation means is preferably designed as a hardware element.

According to the method according to the invention, a data stream to be transmitted can be specifically provided with such errors which are not recognizable by the hardware for detecting errors (for example CRC recognition hardware) on the receiver side. In this way it is possible, inter alia, to quantify the error detection rate of an additional error detection software. The targeted stimulation of such unrecognizable errors also allows the correct functioning of the receiver-side error detection hardware to be checked.

According to a further preferred embodiment, the method according to the invention also stimulates special errors which, with the detection hardware in the receiver, provided with error-free transmission, certainly cause an error. This reliably detects errors in the receiver-side fault test hardware.

The invention also relates to an electronic transmission circuit or a receiving circuit according to claim 7. Furthermore, the invention relates to a transceiver (bus node), which comprises both a corresponding transmitting and receiving circuit. The invention therefore preferably also relates to a serial data transmission system which contains the above circuit elements, wherein these are in particular designed such that the method according to the invention can be carried out with this system.

Finally, the invention also relates to the use of the circuit according to the invention in motor vehicle control devices, in particular in electronic motor vehicle brake systems or electronic vehicle security systems.

Further preferred embodiments will become apparent from the subclaims and the following description of exemplary embodiments with reference to the figures.

Fig. 1

eine schematische Darstellung zweier kommunizierender Knoten eines standardisierten Bussystems,

Fig. 2

eine weitere schematische Darstellung einer Sende- und Empfangsschaltung (Busknoten) mit einer Darstellung der zur CRC-Berechnung und Überprüfung notwendigen Komponenten,

Fig. 3

ein Beispiel für einen gegenüber Fig. 2 erweiterten Busknoten mit erhöhter Sicherheit,

Fig. 4

eine zeitliche Abfolge zur Erläuterung des Wechsels zwischen Testbetrieb und Normalbetrieb für ein ereignisgesteuertes Protokoll wie CAN,

Fig. 5

ein spezielles Ablaufdiagram der einzelnen Schritte innerhalb der zur Validierung vorgesehenen Zeitschlitze in einem Verfahren gemäß Fig. 4 bei Normalbetrieb (online),

Fig. 6

ein Ablaufdiagram einer (intensiven) Untersuchung der Eignung eines Software-Fehlererkennungsverfahrens als sicherheitstechnische Ergänzung der Hardware-CRC-Überprüfung im Testbetrieb (offline),

Fig. 7

eine Darstellung des Inhaltes eines redundanten Sendepuffers zur Nachbildung von Fehlern mit einer Hammingdistanz von 6 bei einer Datenübertragung über CAN (Controller Area Network) und

Fig. 8

eine zeitliche Abfolge zur Erläuterung des Wechsels zwischen Testbetrieb und Normalbetrieb für ein zeitgesteuertes Protokoll, wie Flexray, im statischen Segment.

Show it

Fig. 1

a schematic representation of two communicating nodes of a standardized bus system,

Fig. 2

a further schematic representation of a transmitting and receiving circuit (bus node) with a representation of the components necessary for CRC calculation and verification,

Fig. 3

an example of one opposite Fig. 2 extended bus nodes with increased security,

Fig. 4

a time sequence for explaining the change between test mode and normal mode for an event-driven protocol such as CAN,

Fig. 5

a special flow chart of the individual steps within the time slots provided for validation in a method according to Fig. 4 during normal operation (online),

Fig. 6

a flow diagram of an (intensive) investigation of the suitability of a software error detection method as a safety-related supplement to the hardware CRC check in test mode (offline),

Fig. 7

a representation of the contents of a redundant send buffer to emulate errors with a Hamming distance of 6 for data transmission via CAN (Controller Area Network) and

Fig. 8

a time sequence for explaining the change between test mode and normal operation for a time-controlled protocol, such as Flexray, in the static segment.

• Anwendungsschicht 101,
• Sicherungsschicht 103 und
• physikalische Schicht 105 zur Übertragung der Bits.

Fig. 1 12 shows a schematic block diagram of protocol layers of two bus nodes 100 that communicate via a standardized serial bus system 106. A bus node consisting of transmitter and receiver (transceiver) usually comprises a microcontroller and a communication controller for the communication. In this case, the communication controller can be integrated in the microcontroller. A node 100 can be assigned three protocol layers:

• Application layer 101,
• Link layer 103 and
• physical layer 105 for transmission of the bits.

The application layer 101 is realized as a software, while the link layer 103 and the physical layer 105 are mapped in hardware. The CRC calculation and verification occur in the link layer 103 and are handled in the CRC hardware module 104. With a suitably selected CRC polynomial, the CRC hardware module 104 can detect errors that occur during data transfer on the bus 106 with a high degree of coverage. In order to achieve a high level of security in the transmission, in addition to the hardware CRC check, the software error detection method 102 is also implemented in the application layer 101.

Fig. 2 schematically shows functional blocks of a known bus system with transmitter and receiver, which are needed for CRC calculation and verification. On the transmitter side 303 (see output line Tx), the data bytes belonging to a data telegram are first written in transmit buffer 200. After a parallel-to-serial conversion in block 201, the bits to be transmitted are serially transmitted to the physical layer 105 (see FIG. Fig. 1 ) (Branch A). During transmission, the CRC checksum in the parallel branch B is calculated for the transmitted data. For this purpose, the CRC polynomial is formed by means of shift registers and a feedback using the CRC polynomial coefficients 204. After the last data bit of a data telegram in the physical layer 105 (FIG. Fig. 1 ), the multiplexers 205 and 206 are switched so that the bits of the CRC checksum are also forwarded serially to the physical layer 105.

On the receiver side 304 (see input line Rx), the received serial bit sequence is serial-to-parallel converted and fed to the link layer 103. For the received data bits, a CRC checksum is calculated. Comparator 219 determines if the calculated and received CRC checksums match. If not, there is a transmission error. The control of the functional sequence in the transmitter and receiver is carried out by a finite, in particular common, state machine 231. This cooperates with buffer controller 230 in a suitable manner.

On the transmitter side 303 of in Fig. 3 Bus node shown in addition a redundant (double) path II is implemented. This redundant path II. Consists of a Transmit buffer for a CRC test 240, a parallel-to-serial converter 201 ', and a dedicated CRC hardware module 270. In the signal path followed by multiplexer 243, the bits to be transmitted may be injected into the .mu.s either directly or via inverter 244 in negated form Enter CRC calculation. The output line 248 of the redundant CRC calculation path B 'is connected to the transmission line 208 of the conventional CRC hardware implementation at the inputs of an XOR gate 250. Output 258 of the XOR gate then forms an additional transmit line. On the basis of the multiplexer 271, the control unit of the current protocol can determine which output line (208, 248 or 258) is forwarded to the transmission line Tx. Output line 258 reflects the theoretical property of CRC check algorithms, according to which an XOR of two valid CRC codes must again represent a valid CRC code. By means of this output line, a data telegram can be deliberately falsified such that the hardware CRC check on the receiver side 304 can not detect the implanted error.

Error detection by means of the CRC check in the receiver 304 is not possible in the case of a bit sequence subject to transmission errors if the bit sequence is a valid code word of the selected generator polynomial. In the Fig. 3 More specifically, it can be determined if and how large are gaps for any errors that can not be detected by the CRC hardware. The replica of an "artificial" error is implemented using the XOR link 250 from a stored CRC codeword with the bit string to be transmitted. This operation relies on the property that the CRC calculation of an XOR of two codewords is also a codeword of the considered CRC polynomial supplies. This stimulation means is essentially implemented in hardware, wherein preferably additionally a software interface is provided, with which the bit positions to be falsified can be specified.

The aim now is also to reliably detect the implanted errors that remain undetected by the CRC check with the error detection method 102, which is implemented as software. If this is not the case, there are security gaps that are difficult to quantify. A further improvement in security results from a check of the CRC hardware, in particular the comparator 219, in the receiver itself. If comparator 219 does not perform the validation of the CRC check or performs it incorrectly, the erroneous data may under certain circumstances be passed on unnoticed. The functional groups of the circuit according to Fig. 3 For this purpose, it is also possible to purposefully falsify the checksum of a data telegram in the transmitter 303. Accordingly, it is expected that the receiving node confirms the detection of a CRC error in another data message. This confirmation then indicates the availability of the CRC check in the receiving node. Two ways of corrupting the CRC checksum are in Fig. 3 shown. A first possibility is to feed negated bits into the CRC hardware by means of the multiplexer 243 and the inverter 244. This possibility can be used if a bit vector consisting only of bits of logical value "1" for a given length does not represent a valid code of the selected CRC polynomial. For the second possibility, the checksum is negated before transmission. This can be done with multiplexer 245 and inverter 249.

In Fig. 4 are time slots for the realization of CRC tests during a serial transmission, ie online. The data stream 300 is temporally divided into units of the time length T _{NB of} equal length (time slots for normal operation 302 and test operation 302). It is convenient to provide the timeslots 302 for normal operation longer than the timeslots 301, so that the transmission rate of the serial bus system is not unduly affected by the periodic tests.

• Zwei Botschaften 308 und 310, die jeweils eine fehlerhafte Prüfsumme aufweisen;
• eine Botschaft 309, die einen für die CRC-Überprüfung unerkennbaren Fehler beinhaltet und
• eine Botschaft 311, die fehlerfrei ist.

Fig. 5 serves to explain in more detail the test cycle 301 within the data stream 300 in FIG Fig. 4 , First, the transmitter 303 sends a special start code 306 to the receiver 304, which signals the beginning of the "online" test. Within a bus system with multiple bus nodes, exactly one transmitter and one receiver must be selected for the test. With an acknowledgment message 307, the receiver 304 selected for the test can confirm its readiness for the test. After the acknowledgment message, the checking node 303 sends four data telegrams in succession:

• Two messages 308 and 310, each having an incorrect checksum;
• a message 309 containing an error unrecognizable for the CRC check; and
• a message 311 that is error free.

The order of the messages 308, 309 and 310 can be chosen arbitrarily. The fourth message 311 includes a bit pattern which requests a response 312 from the recipient involved in the test. In response to the sequence of test messages, the receiving node 304 being tested provides a bit pattern 312 containing information about the order of the messages Contains messages 308, 309 and 310. Subsequently, the node 303 transmitting during the test sends a special message 313 to end the test procedure with the test time slot 301. If the response to a request lasts for more than a predetermined amount of time, the test receiver 304 terminates the testing process. A new test procedure takes place again in the following test time slot 301 '( Fig. 4 ). The testing node 303 has means for storing all errors found in CRC test time slots. These can then be read out later during maintenance work. Preferably, if a lack of availability of the CRC check is detected in at least two consecutive time slots, the error is entered into the software running on the checking accounts, for example, interrupt-driven. This allows a suitable response by the software of the bus node to maintain sufficient data security.

In addition to the above-described encapsulation of the CRC check, the likelihood of a corruption error due to transmission errors can advantageously be kept particularly low by sending two different messages with incorrect CRC sums within the CRC check time window. Here, in particular, the second message is formed as bit-inverted information of the first message, while the CRC sums of the two messages are reversed. This embodiment can advantageously be installed with minimal effort in conventional implementations of communication controllers for serial bus systems.

The following will be on hand of Fig. 6 an example of an "offline" method shown. During "offline" operation only tests are carried out. During the test, only test data is transmitted. The "offline" operation serves to check the actual error detection rate of the error detection software 102 (FIG. Fig. 3 ). First, transmitter 303 sends a special start code (time slot 401) which signals the beginning of the "offline" check. In time domain 402, only stimulated data errors are transmitted over the serial link. The test is terminated by a special end code (time slot 403). Due to the "offline" check a lot more bit packets can be checked in a short time than during a check during a serial data transmission ("online"). Again, can be performed by the special nature of the stimulated error checking the error detection quality regardless of the hardware detection of the receiver.

According to a preferred embodiment of the method, the "offline" check described above is first started by stimulating errors with small or smallest Hamming distances. For this purpose, the transmitter preferably comprises a means for adjusting the Hamming distance of stimulated errors (eg by a software program designed for the CRC test in the testing transmitter). The receiver then checks whether the stimulated error has been detected by the recognition software. If an error has not been detected, it is a check gap of the receiver's error detection software. A particularly convenient search for check gaps can be performed by first creating errors with a small Hamming distance and then progressively increasing the Hamming distance. Due to the very large number of possible errors, a meaningful statistical analysis of the frequency of check gaps can be made. On the basis of the above Simulating rare CRC errors, software error detection mechanisms can be advantageously designed to detect any number of wrong bit locations below a certain threshold. The threshold can be set arbitrarily depending on the desired security level.

In Fig. 7 Binary data contents of the CRC test transmit buffer 240 are shown for the example of a transmission over a CAN bus. The illustrated three-bit vectors (# 1 through # 3) are generated (stimulated) to stimulate a CRC screening gap with a Hamming distance of 6. Here, the error stimulation during both an "online" test according to the examples in 4 and 5 as well as during an "offline" test according to the example in Fig. 6 respectively. In the illustrated format of CAN data telegrams, the message identifier 701, the control field 702, and the data field 703 correspond to the contents of the CRC test transmit buffer 240. The CRC check word 704 is calculated for the content of the CRC test transmit buffer 240. A logical value "1" in the CRC test transmit buffer 240 indicates that the corresponding bit location in the transmitter buffer 200 is corrupted during transmission. With the bit vector # 1, an error is simulated only in a data field of 64 bits, while the bit vectors also emulate errors in the CRC check word.

auf eine Bitfolge von 20 Bits angewandt. Mit einem hexadezimalen Anfangswert von "1A" wird eine minimale Hammingdistanz von sechs erreicht. Hierbei führt nur eine geringe Anzahl von Fehlermustern zu einer Hammingdistanz von 6. Diese Fehlermuster ergeben sich beispielsweise aus einer XODER-Verknüpfung eines der folgenden 10 Vektoren mit den zu sendenden 31 Bit eines Flexray-Headers: Null Frame Indicator

Sync Frame Indicator

Frame ID Payload length Header CRC #1 1 1 01010000000 0100100 00000000000 #2 1 0 10011100000 0000000 00001000000 #3 1 1 00001100001 0000100 00000000000 #4 1 0 01100000000 0111000 00000000000 #5 0 0 10111000010 1000000 00000000000 #6 0 0 10100001100 0000001 00000100000 #7 0 0 10000100000 0010000 01001000010 #8 0 0 01000000000 0100000 00011000101 #9 0 0 00010000001 0000001 00000000111 #10 0 0 00000100000 1001000 01000100001 In timed protocols, the signaling is done in time slots for the CRC "online" test according to a comparison to the example in FIG Fig. 5 modified form. Essentially, the steps "error simulation" 309 and "CRC test response" 312 are performed, these steps occupying different time slots. To perform the test described herein, the testing node alternately builds errors in an order determined by it the designated time slots. The responses of the tested node should then reflect the order of the test in the designated time slots. In Fig. 8 To illustrate this principle, a sequence of CRC test time slots 801 and the time slots 802 used for the static segment 803 of a Flexray® protocol used in normal operation is shown. As is known, one Flexray® time slot 802 is assigned two CRC checksums. A CRC checksum is calculated for the header of the message, while the second CRC checksum relates to payload of an application. A CRC test time slot 801 may be reserved for either error simulation or for a CRC test response. For an "offline" check of the Flexray CRC, a static segment consists primarily of CRC test time slots. The flexray header becomes the generator polynomial $${\mathrm{x}}^{\mathrm{11}}\mathrm{+}{\mathrm{x}}^{\mathrm{9}}\mathrm{+}{\mathrm{x}}^{\mathrm{8th}}\mathrm{+}{\mathrm{x}}^{\mathrm{7}}\mathrm{+}{\mathrm{x}}^{\mathrm{2}}\mathrm{+}\mathrm{1}$$

applied to a bit sequence of 20 bits. With a hexadecimal initial value of "1A", a minimum Hamming distance of six is achieved. In this case, only a small number of error patterns lead to a Hamming distance of 6. These error patterns result, for example, from an XOR link of one of the following 10 vectors with the 31 bits of a Flexray header to be sent: Zero frame indicator

Sync Frame Indicator

Frame ID Payload length Header CRC #1 1 1 01010000000 0100100 00000000000 # 2 1 0 10011100000 0000000 00001000000 # 3 1 1 00001100001 0000100 00000000000 # 4 1 0 01100000000 0111000 00000000000 # 5 0 0 10111000010 1000000 00000000000 # 6 0 0 10100001100 0000001 00000100000 # 7 0 0 10000100000 0010000 01001000010 #8th 0 0 01000000000 0100000 00011000101 # 9 0 0 00010000001 0000001 00000000111 # 10 0 0 00000100000 1001000 01000100001

By means of an "offline" check, it can be checked whether a software security layer detects all with a Hamming distance of six simulated error patterns. This makes it possible to ensure that the corresponding node transmits the flexray header with a Hamming distance of 8 and thus has an increased security level. Similarly, the actual effectiveness of CRC protection for Flexray payloads can be verified.

Claims (11)

1. Checking method in which serial data protected by means of check data are transmitted via a serial data bus (106) from a transmitter (303) to a receiver (304), the receiver then conditions at least some of the data and compares them with the transmitted check data in order to recognize transmission errors, wherein the transmitter bases the production of the check data and the receiver bases the conditioning of the data on the same check data formation method, wherein the check data formation/conditioning is performed using error recognition hardware means, and
   wherein particularly also the region of the receiver contains not only the error recognition hardware means but also error recognition software means (102) which are used to additionally check the received data,
   characterized in that
   an error in the transmitted data and/or check data is caused by a transmitter-end error stimulation means.
2. Method according to Claim 1, characterized in that a malfunction or a fault in the error recognition hardware means is recognized in the receiver using the data errors and/or check data errors produced by means of the error stimulation means.
3. Method according to Claim 1 or 2, characterized in that the check data are formed on the basis of the CRC method.
4. Method according to at least one of Claims 1 to 3, characterized in that the erroneous data are produced by virtue of the data to be transmitted being modified by means of the error stimulation means.
5. Method according to at least one of Claims 1 to 4, characterized in that the data errors provoked are produced such that the error recognition hardware means in the receiver can either safely recognize or safely not recognize the data errors during error-free transmission.
6. Method according to at least one of Claims 1 to 5, characterized in that the error recognition software means (102) in the receiver are designed such that they always recognize CRC data errors which are provoked with a Hamming distance below a particular threshold value.
7. Electronic transmission or reception circuit or transceiver which comprises a transmitter and a receiver, having serial data transmission means and in each case at least

   - a physical level,

   - a transmitter-end check data production circuit,

   - a receiver-end check data comparison circuit, and

   - a circuit means (II.), arranged in the transmitter, for provoking erroneous transmitted data and/or erroneous check data,

   characterized by independent additional error recognition implemented at software level in the region of the receiver.
8. Circuit according to Claim 7, characterized in that transmitter-end changeover means (243, 245, 205, 206, 271) are present which can be used to change over between

   a) the production and subsequent transmission of erroneous transmitted data and/or erroneous check data and

   b) the transmission of unmodified data and check data.
9. Circuit according to Claim 7 or 8, characterized in that it is provided with means for carrying out the method according to at least one of Claims 1 to 6.
10. Circuit according to at least one of Claims 7 to 9, characterized in that the transmitter end is provided with a first data conditioning stage (I.), including a first check data production circuit, which can be used to forward data and check data without provoked errors, that is to say usually error-free data and check data, to the transmission output (Tx), and the transmitter end is provided with a second data conditioning stage (II.) having a check data production circuit, wherein the data conditioning stage comprises stimulation means which can be used to produce data errors and/or check data errors which can be forwarded to the transmission output (Tx).
11. Use of the circuit according to at least one of Claims 7 to 10 in motor vehicle controllers.

Images